Case l:20-cv-04651-SDG Document 7-1 Filed 11/18/20 Page 1 of 9 


Affidavit of Russell James Ramsiand, Jr. 

1. My name is Russell James Ramsiand, Jr., and 1 am a resident of Dallas County, 
Texas. 

2. 1 am part of the management team of Allied Security Operations Group, LLC, 
CASOG). ASOG provides a range of security services, but has a particular emphasis 
on cyber security, OSINT and PEN testing of networks. We employ a wide variety of 
cyber and cyber forensic analysts. We have patents pending in a variety of 
applications from novel network security applications to SCADA protection and safe 
browsing solutions for the dark and deep web. 

3. In November 2018, ASOG analyzed audit logs for the central tabulation server of 
the ES&S Election Management System (EMS] for the Dallas, Texas, General Election 
of 2018. Our team was surprised at the enormous number of error messages that 
should not have been there. They numbered in the thousands, and the operator 
ignored and overrode all of them. This lead to various legal challenges in that 
election, and we provided evidence and analysis in some of them. 

4. As a result, ASOG initiated an 18-month study into the major EMS providers in 
the United States, among which is Dominion/Premier that provides EMS services in 
Michigan. We did thorough background research of the literature and discovered 
there is quite a history from both Democrat and Republican stakeholders in the 
vulnerability of Dominion. The State of Texas rejected Dominion/Premier's 
certification for use there due to vulnerabilities. Next, we began doing PEN testing 
into the vulnerabilities described in the literature and confirmed for ourselves that 
in many cases, vulnerabilities already identified were still left open to exploit. We 
also noticed a striking similarity between the approach to software and EMS 
systems of ES&S and Dominion/Premier. This was logical since they share a 
common ancestry in the Diebold voting system. 

5. Over the past three decades, almost all of the states have shifted from a relatively 
low-technology format to a high-technology format that relies heavily on a handful 
of private services companies. These private companies supply the hardware and 
software, often handle voter registrations, hold the voter records, partially manage 
the elections, program counting the votes and report the outcomes. Michigan is one 
of those states. 

6. These systems contain a large number of vulnerabilities to hacking and 
tampering, both at the front end where Americans cast their votes, and at the back 
end where the votes are stored, tabulated, and reported. These vulnerabilities are 
well known, and experts in the field have written extensively about them. 

7. Dominion/Premier ("Dominion") is a privately held United States company that 
provides election technologies and services to government jurisdictions. Numerous 
counties across the state of Michigan use the Dominion/Premier Election 
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Management System. The Dominion/Premier system has both options to be an 
electronic, paperless voting system with no permanent record of the voter’s choices, 
paper ballot based system or hybrid of those two. 

8. The Dominion/Premier Election Management System's central accumulator does 
not include a protected real-time audit log that maintains the date and time stamps 
of all significant election events. Key components of the system utilize unprotected 
logs. Essentially this allows an attacker the opportunity to arbitrarily add, modify, 
or remove log entries, causing the machine to log election events. When a log is 
unprotected, and can be altered, it can no longer serve the purpose of an audit log. 

9. My colleagues and I at ASOG have studied the information that is publicly 
available concerning the November 3, 2020, election results. Based on the 
significant anomalies and red flags that we have observed, we believe there is a 
significant probability that election results have been manipulated within the 
Dominion/Premier system in Michigan. Dr. Andrew Appel, Princeton Professor of 
Computer Science and Election Security Expert has observed, with reference to 
Dominion Voting machines, "1 figured out how to make a slightly different computer 
program that just before the polls were closed it switches some votes around from 
one candidate to another. I wrote that computer program into a memory chip and 
now to hack a voting machine you just need 7 minutes alone with it and a 
screwdriver.” Some of those red flags are listed below. Until a thorough analysis is 
conducted, it will be impossible to know for certain. 

10. One red flag has been seen in Antium County, Michigan. In Michigan we have 
seen reports of 6,000 votes in Antium County that were switched from Donald 
Trump to joe Biden and were only discoverable through a hand counted manual 
recount. While the first reports have suggested that it was due to a glitch after an 
update, it was recanted and later attributed to "clerical error." This change is 
important because if it was not due to clerical error, but due to a "glitch" emanating 
from an update, the system would be required to be "re-certified" according to 
Dominion officials. This was not done. We are skeptical of these assurances as we 
know firsthand this has many other plausible explanations and a full investigation of 
this event needs to be conducted as there are a reported 47 other counties using 
essentially the same system in Michigan. It is our belief (based on the information 
we have at this point) that the problem most likely did occur due to a glitch where 
an update file didn’t properly synchronize the ballot barcode generation and 
reading portions of the system. If that is indeed the case, there is no reason to 
assume this would be an isolated error. This glitch would cause entire ballot uploads 
to read as zero in the tabulation batch, which we aiso observed happening in the 
data (provisional ballots were accepted properly but in-person ballots were being 
rejected (zeroed out and/or changed (flipped)). Because of the highly vulnerable 
nature of these systems to error and exploits, it is quite possible that some, or all of 
these other counties may have the same problem. 

11. Another statistical red flag is evident in the number of votes cast compared to 
the number of voters in some precincts. A preliminary analysis using data obtained 
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from the Michigan Secretary of State pinpoints a statistical anomaly so far outside of 
every statistical norm as to be virtually impossible. There are a stunning 3,276 
precincts where the Presidential Votes Cast compared to the Estimated Voters 
based on Reported Statistics ranges from 84% to 350%. Normalizing the Turnout 
Percentage of this grouping to 80%, (still way above the national average for 
turnout percentage), reveals 431,954 excess ballots allegedly processed. There 
were at least 19 precincts where the Presidential Votes Cast compared to the 
Estimated Voters based on Reported Statistics exceeded 100%. 


Precinct Township 

Votes/SOS 
Est. Voters 

BENVILLE TWP 

350% 

MONTICELLO P-1 

144% 

MONTICELLO P-2 

138% 

ALBERTVILLE P-2 

138% 

ALBERTVILLE P-1 

136% 

BRADFORD TWP. 

104% 

VELDT TWP. 

104% 

CHAMPION TWP 

104% 

KENT CITY 

103% 

WANGERTWP. 

102% 

KANDIYOHI TWP. 

102% 

LAKE LILLIAN TWP. 

102% 

HOKAH TWP. 

102% 

HOUSTON TWP. 

101% 

HILL RIVER TWP. 

101% 

SUNNYSIDE TWP. 

101% 

BROWNSVILLE TWP. 

101% 

OSLO 

101% 

EYOTA TWP. 

101% 


This pattern strongly suggests that the additive algorithm (a feature enhancement 
referred to as "ranked choice voting algorithm" or "RCV") was activated in the code 
as shown in the Democracy Suite EMS Results Tally and Reporting User Guide, 
Chapter 11, Settings 11.2.2. It reads in part, "RCV METHOD: This will select the 
specific method of tabulating RCV votes to elect a winner." For instance, blank 
ballots can be entered into the system and treated as "write-ins." Then the operator 
can enter an allocation of the write-ins among candidates as he wishes. The final 
result then awards the winner based on "points" the algorithm in the compute, not 
actual votes. The fact that we observed raw vote data that includes decimal places 
suggests strongly that this was, in fact, done. Otherwise, votes would be solely 
represented as whole numbers. Below is an excerpt from Dominion's direct feed to 
news outlets showing actual calculated votes with decimals. 
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State 

timestamp 

eevp 

trump 

biden 

TV 

BV 

michigan 

2020-ll-04T06:54:48Z 

64 

0.534 

0.448 

1925865.66 

1615707.52 

michigan 

2020-11-04106:56:472 

64 

0.534 

0.448 

1930247.664 

1619383.808 

michigan 

2020-11-04106:58:472 

64 

0.534 

0.448 

1931413.386 

1620361.792 

michigan 

2020-11-04107:00:372 

64 

0.533 

0.45 

1941758.975 

1639383.75 

michigan 

2020-ll-04T07;01;46Z 

64 

0.533 

0.45 

1945297.562 

1642371.3 

michigan 

2020-11-04107:03:172 

65 

0.533 

0.45 

1948885.185 

1645400.25 


12. Yet another statistical red flag in Michigan concerns the dramatic shift in votes 
betv^een the two major party candidates as the tabulation of the turnout increased. 
A significant irregularity surfaces. Until the tabulated voter turnout reached 
approximately 83%, Trump was generally winning between 55% and 60% of every 
turnout point. Then, after the counting was closed at 2:00 am, the situation 
dramatically reversed itself, starting with a series of impossible spikes shortly after 
counting was supposed to have stopped. The several spikes cast solely for Biden 
could easily be produced in the Dominion system by pre-loading batches of blank 
ballots in files such as Write-Ins, then casting them all for Biden using the Override 
Procedure (to cast Write-In ballots] that is available to the operator of the system. A 
few batches of blank ballots could easily produce a reversal this extreme, a reversal 
that is almost as statistically difficult to explain as is the impossibility of the votes 
cast to number of voters described in Paragraph 11 above. 


Dominion also has a "Blank Ballot Override" function. Essentially a save for later bucket that can 
be manually populated later. 



13. The final red flag is perhaps the greatest. Something occurred in Michigan that 
Is physically impossible, indicating the results were manipulated on election night 
within the EMS. The event as reflected in the data are the 4 spikes totaling 384,733 
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ballots allegedly processed in a combined interval of only 2 hour and 38 minutes. 
This is physically impossible given the equipment available at the 4 reference 
locations (precincts/townships) we looked at for processing ballots, and cross 
referencing that with both the time it took at each location and the performance 
specifications we obtained using the serial numbers of the scanning devices used. 
(Model DRM16011 - 60/min. without accounting for paper jams, replacement cover 
sheets or loading time, so we assume 2,000 ballots/hr. in field conditions which is 
probably generous). This calculation yields a sum of 94,867 ballots as the 
maximum number of ballots that could be processed. And while it should be noted 
that in the event of a jam and the counter is not reset, the ballots can be run through 
again and effectively duplicated, this would not alleviate the impossibility of this 
event because duplicated ballots still require processing time. The existence of the 
spike is strongly indicative of a manual adjustment either by the operator of the 
system (see paragraph 12 above) or an attack by outside actors. In any event, there 
were 289,866 more ballots processed in the time available for processing in 
four precincts/townships, than there was capacity. A look at the graph below 
makes clear the This is not surprising because the system is highly vulnerable to a 
manual change in the ballot totals as observed here. 


lOOOOO 


2020 SpAad Vote Totals per County in Ml 


Oakland; 

BKlen ♦90,912 (26K) 
Trump ♦36,713112«) 


Kant; 

Bidan ♦48,070 (34%) 
Trump ♦17,138(11%) 


Macomb; 

ftkJan; ♦49.244 (28%) 
Trump: ♦39,870(17%) 
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Wayne; 

B*dcn ♦67.630(15%) 
Trump ♦35,156(13%) 
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14. At ASOG, we believe that these statistical anomalies and impossibilities together 
create a wholly unacceptable level of doubt a.s to the validity of the vote count in 
Michigan, and in Wayne County, in particular. 
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15. If ASOG, or any other team of experts with the equivalent qualifications and 
experience, could be permitted to analyze the raw data produced during the course 
of the election, as well as the audit logs that the Dominion system generates, we 
would likely be able to determine whether or not any fraudulent manipulation of 
the election results occurred within the Dominion Election Management System. 
These audit logs are in the possession of Dominion. 

16. However, there are several deficiencies with the Dominion audit logs: (1) 
because the logs are "voluntary" logs, they do not enforce the logging of all actions; 
(2) the logs can be altered by the people who are operating the system; and (3) the 
logs are not synchronized. Because of these deficiencies, it is of critical importance 
that all of the daily full records of raw data produced during every step of the 
election process also be made available for analysis (in addition to the audit logs], so 
that gaps in the audit logs may be bridged to the best extent possible. This raw data, 
which is in Dominion’s possession, should be individual and cumulative. 

17. Wayne County uses Dominion Equipment, where 46 out of 47 
precincts/townships display a highly unlikely 96%+ as the number of votes cast, 
using the Secretary of State's number of voters in the precinct/township; and 25 of 
those 47 precincts/townships show 100% turnout 


Precinct Township 
SPRUCE GROVE TWP 
ATLANTA TWP 
RUNEBERG TWP 
WOLF LAKE TWP 
HEIGHT OF LAND TWP 
EAGLE VIEW TWP 
WOLF LAKE 
SHELL LAKE TWP 
SAVANNAH TWP 
CUBA TWP 
FOREST TWP 
RICEVILLE TWP 
WALWORTH TWP 
OGEMA 

BURLINGTON TWP 
RICHWOOD TWP 
AUDUBON 
LAKE EUNICE TWP 
OSAGE TWP 
DETROIT LAKES W2 PI 
CORMORANT TWP 
LAKE VIEW TWP 


Votes/SOS 
Est. Voters 


100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 

100 % 
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AUDUBON TWP 100% 

DETROIT LAKES W3 PI 100% 

FRAZEE 100% 

This pattern strongly suggests both the additive algorithm (a feature enhancement 
referred to as "ranked choice voting algorithm" or "RCV") was activated in the code 
as discussed in paragraph 11 above, as well as batch processing of blank votes, as 
outlined in Paragraphs 12 and 13 above, where 74,119 more ballots were cast than 
the capacity to cast them during the spike. 

18. In order to analyze the data and determine the cause of these anomalies, ASOG 
would need Administrator logs for the EMS Election Event Designer (EED) and EMS 
Results Tally & Reporting (RTR) Client Applications. The following would be 
required from Premier: 

XML and XSLT logs for the: 

• Tabulators 

• Result Pair Resolution 

• Result Files 

• Provisional Votes 

• RTM Logs 

• Ranked Profiles and entire change history Audit Trail logs 

• Rejected Ballots Report by Reason Code 

Identity of everyone accessing the domain name 
Admin.enr.dominionvoting.com and 

• Windows software log, 

• Windows event log and 

• Windows security log of the server itself that is hosted at 
Admin.enr.dominionvoting.com. 

• Access logs to their full extent and DNS logs. 

• Internal admin.enr.dominionvoting.com logs 

• Ranked Contests and entire change history Audit Trail logs 

FTP Transfer Points Log 

19. In order to evaluate the raw data of the election, the following records would be 
required from Dominion. 

• Daily and Cumulative Voter Records for those who voted with sufficient 
definition to determine: 

Voters name and Registered Voting address 

Address to for correspondence 

D.O.B. 

Voter ID number 

How Voted (mail, in-person early, in person Election Day) 

Where Voted (if applicable) 
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AUDUBON TWP 100% 

DETROIT LAKES W3 PI 100% 

FRAZEE 100% 

This pattern strongly suggests both the additive algorithm (a feature enhancement 
referred to as "ranked choice voting algorithm" or "RCV") was activated in the code 
as discussed in paragraph 11 above, as well as batch processing of blank votes, as 
outlined in Paragraphs 12 and 13 above, where 74,119 more ballots were cast than 
the capacity to cast them during the spike. 

18. In order to analyze the data and determine the cause of these anomalies, ASOG 
would need Administrator logs for the EMS Election Event Designer (EED) and EMS 
Results Tally & Reporting (RTR) Client Applications. The following would be 
required from Premier: 

XML and XSLT logs for the: 

• Tabulators 

• Result Pair Resolution 

• Result Files 

• Provisional Votes 

• RTM Logs 

• Ranked Profiles and entire change history Audit Trail logs 

• Rejected Ballots Report by Reason Code 

Identity of everyone accessing the domain name 
Admin.enr.dominionvoting.com and 

• Windows software log, 

• Windows event log and 

• Windows security log of the server itself that is hosted at 
Admin.enr.dominionvoting.com. 

• Access logs to their full extent and DNS logs. 

• Internal admin.enr.dominionvoting.com logs 

• Ranked Contests and entire change history Audit Trail logs 

FTP Transfer Points Log 

19. In order to evaluate the raw data of the election, the following records would be 
required from Dominion. 

• Daily and Cumulative Voter Records for those who voted with sufficient 
definition to determine: 

Voters name and Registered Voting address 

Address to for correspondence 

D.O.B. 

Voter ID number 

How Voted (mail, in-person early, in person Election Day) 

Where Voted (if applicable) 
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Date voted (if applicable) 

Party afniiation (if recorded) 

Ballot by mail Request Dale 

Ballot by mail sent date 

Ballot by mail voted date (If applicable) 

Ballet cancelled date (if applicable) 

• RAW. HTMU XHTML and SVG RIes (Ballot images) 

20. Any removable media (such as thumbdrives, USB, memory cards. PCMIA cards, 
etc) used to transfer ballots to central counting from voting locations. 

21. Access or control of ALL routers, tabulators or combinations thereof (some 
routers are Inside the tabulator case) in order to gamer the system logs. At the 
same time, the puMic IP of the router should be obtained. 

22. Any key, authorlxation key & yubtkey 
Further affiant sayeth naught 



Notary public: 
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